mirror of
https://github.com/giancarloerra/socraticode.git
synced 2026-07-03 14:05:21 +02:00
Giancarlo Erra
49 lines
2.0 KiB
Markdown
49 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in SocratiCode, please report it responsibly.
|
|
|
|
**Do NOT open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Instead, email **[giancarlo@altaire.com](mailto:giancarlo@altaire.com)** with:
|
|
|
|
- A description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Any suggested fixes (optional)
|
|
|
|
You will receive an acknowledgment within 48 hours and a detailed response within 7 days indicating next steps.
|
|
|
|
## Scope
|
|
|
|
This policy applies to the SocratiCode codebase and its managed Docker infrastructure (Qdrant and Ollama containers). It does not cover third-party services you may connect to (cloud Qdrant, OpenAI API, Google Gemini API).
|
|
|
|
## Security Model
|
|
|
|
SocratiCode is designed to run locally by default:
|
|
|
|
- **No data exfiltration** — In the default configuration (Ollama + Docker Qdrant), all data stays on your machine. No external API calls are made.
|
|
- **No network listeners** — The MCP server communicates over stdio only. It does not open any HTTP endpoints.
|
|
- **Docker isolation** — Qdrant and Ollama run in Docker containers with only the necessary ports exposed on localhost.
|
|
- **No credentials stored** — API keys (OpenAI, Google, Qdrant) are passed via environment variables at runtime, never written to disk.
|
|
|
|
### When cloud providers are used
|
|
|
|
If you configure `EMBEDDING_PROVIDER=openai` or `EMBEDDING_PROVIDER=google`, code chunks are sent to the respective cloud API for embedding generation. This is an explicit opt-in. The default configuration never contacts external services.
|
|
|
|
## Supported Versions
|
|
|
|
Only the latest release is supported with security updates.
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| Latest | Yes |
|
|
| Older | No |
|
|
|
|
## Disclosure Policy
|
|
|
|
- Vulnerabilities will be patched and released as soon as practical
|
|
- A security advisory will be published on GitHub after the fix is available
|
|
- Credit will be given to reporters unless they prefer to remain anonymous
|